By: Stephen Calder
Director Risk & Assurance
Cyber security assurance for NSW councils is increasingly about more than policies, technology and compliance. For council executives and Audit, Risk and Improvement Committees, the critical question is no longer “Are we secure?” It is: “What independent evidence do we have that our most important cyber risks are understood, controlled and recoverable?”
That distinction matters. Policies, dashboards and technology investments can create an impression of control, but confidence without evidence is not assurance. In a threat environment shaped by third-party platforms, cloud services, ransomware and increasingly connected operations, leaders need a clear view of where exposure sits, whether key controls work, and whether critical services can continue when those controls fail.
In May 2026, Mosman Council advised that it was investigating a cyber incident involving a third-party digital platform used to support some community services. In July 2026, ID Support NSW reported that the Council was contacting individuals whose personal information may have been affected. The incident is a timely reminder that councils may not own every system or vulnerability, but they remain accountable for managing the operational, privacy and community impacts that follow.
Third-party risk is therefore not simply a procurement or technology matter. It is an executive risk requiring visibility, ownership and assurance.
Cyber awareness should not end with staff reminders and phishing simulations. For executives, it should prompt a more disciplined conversation about risk, control effectiveness and resilience.
The most useful questions are often the most direct:
Effective cyber assurance does more than produce a compliance score. It connects council obligations and recognised frameworks to the systems, services and decisions that matter. It provides leaders with a defensible view of current maturity, identifies control gaps, tests whether controls operate in practice and helps prioritise investment.
Centium supports NSW councils through independent, risk-based cyber assurance services, including:
Our assurance approach brings together cyber, risk, governance, internal audit and resilience expertise. The aim is not to add another report to the shelf. It is to give executives and ARICs a clear, evidence-based understanding of exposure, practical priorities for improvement and confidence that agreed actions address the risks that matter most.
A cyber incident rarely remains an IT problem. It can quickly affect customer-facing services, regulatory obligations, financial processes, privacy, communications and public trust.
This is why cyber assurance must extend beyond prevention. Councils also need evidence that they can detect an incident, make timely decisions, communicate appropriately, restore priority systems and maintain critical community services.
Centium’s business continuity and resilience services complement cyber assurance through business continuity framework development, independent plan reviews and gap analyses, crisis and incident response planning, training, and realistic scenario exercises. Testing is particularly valuable because it exposes hidden dependencies, unclear accountabilities and recovery assumptions before a real incident does.
Cyber Awareness Month is an opportunity for council leaders to move beyond general awareness and ask for evidence. Strong governance begins with knowing where the organisation is exposed. Strong assurance establishes whether controls are effective. Strong resilience is demonstrated by testing what happens when prevention is not enough.
Centium can provide an independent cyber assurance review tailored to your council’s risk profile, operating environment and assurance plan. We can assess current maturity, test priority controls, review third-party and continuity arrangements, and translate the results into a practical, risk-ranked improvement roadmap for management and the ARIC.
If your executive team or ARIC cannot confidently answer the five questions above, now is the time to establish the evidence. Contact Centium to discuss a targeted cyber health check, an OLG and Essential Eight maturity assessment, or an integrated cyber resilience review.
Centium is an Australian management consultancy specialising in risk, governance, assurance, cyber and information management, and organisational resilience. Centium has delivered cyber security reviews, health checks, maturity assessments and continuity engagements across NSW local government and the broader public sector.
Sources
NSW Government, ID Support NSW, “Mosman Council cyber incident”, published 2 July 2026.
